CVE-2022-41862 : In PostgreSQL, a modified, unauthenticated server can send an unterminated strin

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

Published 2023-03-03 16:15:09

Updated 2023-04-27 15:15:10

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2022-41862

Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Integration Camel K » Version: N/A
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*
Matching versions
Redhat » Integration Camel Quarkus » Version: N/A
cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*
Matching versions
Redhat » Integration Service Registry » Version: N/A
cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*
Matching versions
Postgresql » Postgresql
Versions from including (>=) 15.0 and before (<) 15.2
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Matching versions
Postgresql » Postgresql
Versions from including (>=) 13.0 and before (<) 13.10
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Matching versions
Postgresql » Postgresql
Versions from including (>=) 12.0 and before (<) 12.14
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Matching versions
Postgresql » Postgresql
Versions from including (>=) 14.0 and before (<) 14.7
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 8
cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2022-41862

Top countries where our scanners detected CVE-2022-41862

Top open port discovered on systems with this issue 80

IPs affected by CVE-2022-41862 146,097

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2022-41862!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2022-41862

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 40 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-41862

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
3.7	LOW	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	2.2	1.4	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2022-41862

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: secalert@redhat.com (Secondary)

References for CVE-2022-41862

https://bugzilla.redhat.com/show_bug.cgi?id=2165722

2165722 – (CVE-2022-41862) CVE-2022-41862 postgresql: Client memory disclosure when connecting with Kerberos to modified server
Issue Tracking;Third Party Advisory
https://www.postgresql.org/support/security/CVE-2022-41862/

PostgreSQL: CVE-2022-41862: Client memory disclosure when connecting, with Kerberos, to modified server
Vendor Advisory
https://security.netapp.com/advisory/ntap-20230427-0002/

CVE-2022-41862 PostgreSQL Vulnerability in NetApp Products | NetApp Product Security